Supporting the Legal Identities of Contracting Agents with an Agent Authorization Platform Changjie Wang, Ho-fung Leung Dept of Comp Science and Engineering, The Chinese University of Hong Kong, {cjwang, lhf}@cse.cuhk.edu.hk Dickson K. W. CHIU Dickson Computer Systems kwchiu@acm.org, dicksonchiu@ieee.org Irene Kafeza Faculty of Law, University of Hong Kong kafeza.e@dsa.gr Eleanna Kafeza Department of Marketing and Communications, Athens University of Economics and Business kafeza@aueb.gr

Motivation and Background No legislations governing automatic agent transactions except one preliminary attempt in the USA Can be used easily as a means for fraud and deception The rules are not clear: lack of adequate legal response, international standards, and the cross-border nature of electronic trade Hinders massive adoption What happen if the agent does not act as the user’s expectation Wrong user instructions? Malfunction of the agent? The agent is manipulated by a third party? System failure? … ??? Difficult to proof Key problem rooted at the necessary means of trust Authorization management in agent delegation Legal identity of agents Proposed solution: Agent Authorization Platform Agent Authorization Platform

Elements of a Contract “A contract is a promise or a set of promises for the breach of which the law gives a remedy, or the performance of which the law in someway recognizes as a duty.” (US Laws of Contracts) (1) An agreement Examine whether the negotiations that have taken place between the parties (offeror / offeree) can be defined as an offer and acceptance (2) An intention from both parties to be legally bound Attribute to the person his executed intention and not what was present in his mind For agents, check how it acted on relevant situations and what are the parameters of the user’s instructions on how to react under these situations. (difficult!) (3) A valuable consideration Agent Authorization Platform

Valid and enforceable contracts Requires persons with contractual capacity Legal obligations are connected to contracts USA: Uniform Computer Information Transactions Act (UCITA) – provides a full set of commercial law rules for computer information transactions An “Electronic agent” is defined as a computer program, or electronic or other automated means, used by a person to initiate an action, or to respond to electronic messages or performances, on the person’s behalf without review or action by an individual at the time of the action or response to the message or performance Agent Authorization Platform

Agents as legal person Physical Persons vs. Legal Persons Debatable … Examples of legal persons - a corporation, a government entity, a ship Exist only when they have assets Legal personality will enable agents to have rights and duties to sue and be sued to own assets Agent Authorization Platform

Can agents convey a promise? When intelligent agents negotiate a deal, they cannot manifest assent in the same way as humans. A party that enters into a contract has to be aware of the commitment and this is guaranteed if the party manifests assent of the terms. Many law scholars point out that we can assume that a person manifests assent by conduct when using an electronic agent. One might consider that intelligent agents serve the same function as human agents => legal personality. Difficulty: a mutual assent on the nature and scope of the rights and obligations between the parties (meeting of the minds) is necessary – need a new technical solution for the case of agents Agent Authorization Platform

Solution Overview Legal Solution: Proper legal identity of agents Compare agents with a registered corporation Possibility of real asset granted from owner Agents then sue and be sued Future work … Technical Solution: Agent Authorization Platform for agent authorization and identity management Agent Authorization Platform

Overview of Agents’ Contractual Capability Increasing Autonomous Capability Agent Authorization Platform

Major Functions of the AAP Issue of electronic agent certificates Authentication of the users and their agents through electronic certificates Validation of agents’ bids Witness of electronic contracts with validation to ensure contract terms are with the agents’ authorization limits Alert agents’ owners in case of authorization violations Non-repudiation support Agent Authorization Platform

A Conceptual Model for Agent Authorization Agent Authorization Platform

AAP System Architecture Authorization Database Authorization Validator Alert Management System Web / WAP Access Alert Agent Programmatic Interface Non-Repudiation Server Desktop Laptop PDA Mobile Human Users Agents Agent Authorization Platform AAP Portal Internet Alert Sender Authorization Profile Editor Agent Certification Center Agent cert Agent registration request E-contracts Validation logs Violation profile AVR = Authorization validation request AVR Front-end Tier Logical Tier Back-end Tier Certificate Authorities Agent Authorization Platform

AAP Protocol Overview Authorization Platform (AAP) (3)Agent issuing (1)Agent request Customer agent Verification Module (4)Agent verification (2)Agent preparation (5)Negotiation Agent certificate center Seller (6)Authorization validation Authorization Database Non-repudiation Database (7)Contract signing agent (8)Agent return Authorization Platform (AAP) Agent Authorization Platform

Agent Request Flow Chart Customer C Verification Module Customer request ReqC Record agent authorization Verification failed, reject the request Authorization Database Record non-repudiation data Non-repudiation Database Agent generation receipt Inform agent formatting Agent certificate center Agent Authorization Platform (AAP) Agent Authorization Platform

Agent Certificate Agent identification number (AIN) Buying description Authorization Profile Time stamp and the period of validity Agent public key Other static data Public Key Algorithm specification SigAAP(Above data) AAP certificate CertAAP Agent Authorization Platform

Authorization Validation Protocol Agent Authorization Platform (AAP) Verification Module Agent Pre-contract signing Authorization validation request Agent certificate center Host Authorization confirmation and final contract signing Authorization Database Non-repudiation Database Authorization profile update Customer Agent Authorization Platform

Advantages of our approach AAP provides a solid foundation for establishing enforceable trust proper encoding of users’ requirements, intention, and preferences ensure whatever happens cannot violate the agents’ authorization limit the final electronic contract is validated against the agents’ authorization or with the users’ explicit consent adequate evidences to avoid most of the legal ambiguities Technical aspects - agent reliability Social aspects - build up of trust and a positive image of technical reliability Agent Authorization Platform

Summary Various legal ambiguities rooted at Authorization management in agent delegation Legal identity of agents AAP provides a technical solution Legal solution We do not intend to solve all the legal issues immediately but we propose a solid foundation Expect gradual adoption, cf. adoption of PKI in e-commerce Agent Authorization Platform

Future Work Maintaining legal personality Contributions to reliability Transfer of assets to agents Insurance for agents Contributions to reliability Constraints and requirement specifications Application of Semantic Web and ontology Enactment of new legislations similar to the legal acceptance of e-certs in electronic transactions Agent Authorization Platform

Question and Answer Thank you! Agent Authorization Platform